API Keys
Learn how to generate and manage API keys for authenticating with the Mimasa AI API. Keys are the recommended credential type for server-to-server integrations that act as the workspace itself rather than as an individual user.
Generating Keys
API keys are created from the workspace settings by a workspace admin and are shown only once at creation time, so store the value in a secrets manager immediately. Each key is scoped to a single workspace and is bound to a set of roles, meaning it can only reach the workflows, dashboards, data sources and reports that those roles are permitted to see. Send the key as a bearer credential in the Authorization header on every request to https://api.mimasa.ai/v1.
Key Permissions
Every API key inherits the same role-based access control model used across the platform, so a key is only ever as powerful as the role it was issued under. Read-only roles can list and fetch resources, while roles with write access can create workflows, update dashboards or trigger report generation. Scoping keys narrowly, rather than granting broad admin roles to automation, limits the blast radius if a credential is ever leaked.
Rotating Keys
Because a compromised key grants ongoing programmatic access to a workspace, keys should be rotated on a regular cadence and immediately after any suspected exposure. Generate a new key, update the credential in your integration, confirm traffic has shifted, and only then revoke the old key so requests in flight are not disrupted. Revoked keys stop working immediately and any request signed with them returns an authentication error.